Add support for IdP-initiated login

Add support for IdP-initiated login

This uses the Redirect SSO endpoint and two new optional
arguments: SPIdentifier and RelayState.

SPIdentifier is the provider ID of the SP.
RelayState is where on the SP the user should be sent.

If the user is already authenticted then a SAMLResponse is generated
and the existing HTML page is generated and sent to the user including
this response and the value of RelayState (if any). This will then POST
to the SP and the user will be show the page on the SP.

If the user is not authenticated then they will be given the login page
after which they will be sent to the SP.

The link to the SP on the IdP Portal has changed to be and IdP-initiated
login. If a user bookmarks this link then they will always go to that
SP and be authenticated first, if needed.

https://fedorahosted.org/ipsilon/ticket/138

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-by: John Dennis <jdennis@redhat.com>